Due Process in Cyberspace

David R. Johnson

Introduction

Online communication has given rise to a new global
commerce in ideas, information and services. Because electronic
messages readily cross territorial borders, and many online
transactions have no necessary relationship to any particular
physical location, existing geographically-based legal systems
have difficulty regulating this new phenomenon. As users and
system operators encounter conflicts and seek to resolve
disputes, they take action to establish rules and decide
individual cases. This creates a new form of law -- a law of
Cyberspace -- based on private contracting on a global
basis and enforced by a combination of the sysop's ultimate right
to banish unruly users and the users' ultimate right to migrate to
other online service providers.

Will this emerging netlaw provide "due process"? Will it,
in other words, respect basic principles of fairness, as embodied
in current legal doctrines in the form of procedural protections
against arbitrary action by governmental authorities and
substantive rights not to have life, liberty and property taken
away to serve the interests of an oppressive majority? There are
some signs that the emerging netlaw will honor basic principles
of procedural fairness and respect for individuals. However, the
goal is to protect users from arbitrary actions of their
information service providers rather than from arbitrary actions
of their governments. Consequently, the methods used to
achieve this goal online must differ from those available in
established national legal systems.

Is Due Process Necessary in Cyberspace?

At first glance, global online communications might
not seem to be in need of special protections for users or
specific limitations on the prerogatives of system operators. A
decision to sign up with an online commercial service or an
Internet service provider is clearly voluntary -- unlike
involuntary subjugation to territorial laws imposed by local
sovereigns. The rules of the electronic road are set, for the
most part, by private contracts -- not by legislators enacting
statutes, administrators making regulatory decisions, or
judges interpreting the law. If a system operator adopts rules
that seem oppressive, the local "netizenry" can vote with their
modems and go to another, more congenial, jurisdiction. Indeed,
it is possible for some technologically sophisticated users to
transmit messages without dealing through intermediaries who know
who they are or who can enforce compliance with any
established rules.

This primary reliance on action by private parties is
important in establishing the relative freedom of users of the
net from governmental intrusion. But there remain important
questions raised by the potential of system operators, or
majorities of communities of users, to oppress individuals and
minorities. While those who disagree with local rules are free to
migrate, many users will have invested very substantial amounts of
time and effort in establishing a particular online identity
(building a reputation based on a particular email address or web
page location, for example). And many seek to participate actively
in particular online communities, over long periods of time. For
them, separation from those communities would impose very
substantial personal loss. Thus, the check on sysop power
provided by the user's right to abandon an online area is
importantly mitigated by the costs imposed on the user who walks
away. And the sysop's power of banishment can become the
occasion for substantial injustice if it is imposed without
adequate cause or without the use of procedures that give the
user (and, perhaps, the cybercommunity) a chance to be heard.

Some system operators will challenge the relevance of
"due process" in the networld, stressing that the rights assured
apply only to limit powers exercised by sovereign governments.
They will also protest that private commercial and associational
dealings are not generally burdened with prohibitions against
irrationality. What for government is prohibited censorship is,
for a private electronic publisher, editing. What for government
constitutes discrimination is, for an online community, the
right of free association.

The arguments for some form of protection in netlaw for
users' right may prove persuasive, however, because traditional
legal authorities have difficulty regulating a global electronic
network, because the entrepreneurs advocate self-regulation, and
because the system providers may become the effective "government"
of the networld. They collectively do have a monopoly on what
passes for "force" in this environment (the off-on switch).
Especially insofar as they band together to establish standards,
as they have already done, in effect, to create the Internet
protocols and domain name system and associated rules,
collectively they do exercise something akin to sovereignty
within their particular sphere.

Sysops may have to admit that the stakes involved in
disputes about the creation or application of online rules can be
high, from the perspective of a user. If they are not constrained
by some basic principles of fairness and respect for individual
rights, evolved within the context of the networld culture, then
external governments may be unwilling to defer to netizen claims
to a right to self-government. Moreover, a failure to protect
online rights to "life, liberty and property" in the networld
would likely deter many potential participants and stifle online
commerce.

What Due Process is Now Provided to Users?

Rules online may be promulgated either by common
practices developed users or as a result of private contract
between provider and user. Most of these contractual rules are
set by contracts of adhesion, with little or no opportunity for
bargaining. Many commercial service providers' contracts purport
to reserve to the sysop the right to deny service to anyone at
any time for any reason. Sometimes users demand changes to online
rules -- and interactive capability online provides ample
opportunity, as a practical matter, to petition their online
governments and to discuss preferable changes. But there is no
established procedure or practice of putting proposed changes out
for comment. To the contrary, many contracts for
online services provide that the user agrees in advance to abide
by the system's rules however arbitrary they might be or however
they may change in the future. The user's only recourse, in
extremis, is to quit the system if a new rule change is
objectionable.

Similarly, most cases involving application of online
rules to particular cases and specific users proceed on the basis
of unilateral action by the system operator, who acts as
prosecutor, judge, jury and executioner. There have been
exceptions -- such as the famous case of the multi-user domain
(Lamda Moo) whose users called for the creation of an independent
judiciary after one member was had his ID rendered
nonfunctional by the "wizard" on the basis a public outcry
against anti-social conduct by that user. Now a pilot project has
been initiated to establish a "Virtual Magistrate" to rule on
online disputes, via email, that would give those with claims
regarding the application of online rules a chance to have their
cases heard by a neutral party. At the present justice in
cyberspace is summary justice (or self-help vigilante revenge).

The current lack of meaningful protection in cyberspace
is ironic, given the potential the medium offers to facilitate
rational dispute resolution and public debate. Online conferences
can readily marshall diverse views regarding proposed
regulations. (The Nuclear Regulatory Commission is experimenting
with online rulemaking and Congress has discovered that email is
an effective means for at least some constituents to make their
views known.) Moreover, focused adjudications can be conducted
much more cost effectively online than in the real world. All
parties can attend at their convenience. Experts and neutrals can
be located and consulted quickly online. The entire proceeding can
be archived as part of an electronic record. The net can
thus facilitate thoughtful discussion of new rules, rational
analysis of the facts, and expeditious adjudication of online
controversies.

How Will Due Process Arise in Cyberspace?

As the number of online services and users increase, the
number of disputes and the magnitude of the interests affected by
such disputes, will also increase. Formerly what the techie in
the back room called your computer server did not matter. Today
large companies contend aggressively to trademark "domain names"
and to maintain a legally protected space to call their own.
It doesn't matter much that your phone number changes when you
change jobs. But some employees may face serious disruption in
their professional lives if their prior service provider declines
to forward their email. Many intensive users of online
communication would recoil in horror at the thought that a system
operator could unilaterally destroy their online identity without
cause, or that a committee of techies who administer naming
conventions in the networld could eliminate their hard-won web
page addresses based upon engineering concerns. They have come to
expect a legally guaranteed entitlement to present one's case and
to seek to establish individual rights against oppression. They
will likely insist upon proprietary rights in phone numbers, email
addresses, and web page identities as well as entitlement to a
reasonable presentation of their grievances.

The first stage in the development of such online due
process rights will take the form of recognition that important
personal (and corporate) interests are at stake. This may at
first take the form of appeals to existing legal authorities for
protection. But local authorities cannot easily control a global
net, may not have jurisdiction over all relevant parties, and will
be inclined to defer to the terms of the contracts that users
agreed to as a condition of going online. So these appeals will
ultimately have to be made directly to system operators and,
ultimately, to the group of interconnected systems that,
collectively, control most of the traffic exchanged on the
net. Collectively, those who control access to the interconnected
systems have the power to discipline or deny interchange of
messages to sites that fail to conform to a Cyberspace norm.

The Internet community, of long term users, has
demonstrated its ability (via the IETF, for example) to come up
with policies and protocols that govern the technical transmission
of messages across the net and make the entire system work. Those
who don't go along with these rules have systems that simply don't
interconnect. Similarly, rules regarding "due process" for users
can be effectively adopted by consensus, so long as this higher
level type of "standard" or "protocol" is a required condition for
connection or for inclusion in the groups collaborating to enhance
the functionality of online communications. Some elements of such
principles may be based, in part, on technical architectures --
such as the location of authority to change a domain name. Some
may simply correspond to accepted practice for dealing with user
complaints or rule violations, failure to follow which might make
an area of the networld suspect or less frequently pointed to by
means of hypertext links supported by responsible providers.

The principles and basic rights that gain general acceptance
-- such as the transportability (or ownership by the user) of a
domain name -- are unlikely be embodied in a written
constitution. The technology of global online communication is
developing so rapidly that it will be difficult to deal with many
potential issues by means of such written rules. The Internet
community has responded to this difficulty in part by developing a
loose doctrine of "netiquette" that is based on group discussion
and can adapt in a manner similar to the common law. Accordingly,
there will likely be no definitive "law library" of authoritative
texts from which one can determine the extent of due process
protection accorded in the networld -- and even past cases,
though widely reported, will need to be discussed from time to
time in light of new conditions. There will be only a weak
version of "stare decisis" on the net, because the rational
presumption will be that relevant circumstances (including the
capabilities of technologies and the mix and interests of online
participants) may well have changed since the last time an issue
was considered. But there will be wisdom derived from discussion
among informed and neutral parties.

For example, when "spamming" (sending multiple, offpoint
messages to news groups) became a problem in the Internet, the
offended users took direct, vigilante action -- flooding
the offending party's mailbox with hate mail. But there turned
out to be a technical means to eliminate inappropriate messages
much more surgically -- a cancellation message appearing to come
from the originating party (a "cancelbot") could be sent. Soon a
discussion group was formed to spread news of new spamming
episodes and also to deliberate on when and whether this
"cancelbot" technology should be used to remove offensive
messages. Some self-help justice is still present, of course, but
the reaction to spamming has generated a growing sense that severe
actions taken to protect the online public's interests -- whether
canceling messages or eliminating IDs -- ought to be preceded by
thoughtful discussion and implemented by a neutral
decision-maker. This cultural practice has the potential to
become, in effect, a type of "due process" right enjoyed by
all users in the networld.

How will Due Process on the Net Differ from Due Process in
the Non-Virtual World?

"Due Process" in Cyberspace may arise in the form of a
general consensus among most users and sysops that the ultimate
enforcement tools available (banishment, cancellation of IDs,
elimination of online addresses) ought not to be wielded
arbitrarily. Users will avoid systems that reserve to the sysop
the right to terminate a user, or alter valuable identifying
information, or adopt rules prohibiting legitimate and established
activities, arbitrarily. Users accused of wrongdoing will demand
and get a hearing -- and any cavalier treatment of individual
cases will be widely reported and discussed in a manner
detrimental to the callous system operator. Such protection cannot
readily be built directly into the laws of local sovereigns, who
may not even have jurisdiction over all of the interested
parties. They will, however, become part of what connecting system
operators expect from one another and what users in general
demand. They will become, in effect, a form of private global
netlaw, probably applied by private arbitration and enforced by
means of all parties' ability to decide with whom they will deal.

Under United States law, due process is guaranteed by
virtue of a written constitution, covering a particular
geographically defined place and its citizens. It is based upon
key conceptions regarding the duty of a "state" to serve the
interests of its citizens in an equitable manner. In contrast,
the protection of fairness for individual users in the global
networld will rely less upon the law of territorially based
jurisdictions and more upon the actions of online communities.
The efficacy of netlaw will depend more upon sysops who control
the on-off buttons and the reactions of their customers, wherever
they may reside, than they will upon theories relating to limits
of "sovereign" powers.

Moreover, the nature of the beneficiaries of the online
version of "due process" may differ from that of those who can
invoke the established "real world" doctrines. Users can do
business online without necessarily disclosing the details of
their identity or the other roles they play in the real world.
Thus, those who formulate the doctrine of online due process will
need to decide whether such rights attach to any online
"persona", whether the user claiming rights must disclose
additional personal information as a condition of appearing in
the forum that can vindicate any such right, and whether rights
to "life, liberty and property" online may belong to a group or
"corporate" entity.

Perhaps the most important question regarding "due
process" in cyberspace concerns the online equivalent of the
right to life, a question presented when a sysop desires to
remove an online identity against the wishes of the user. This
kind of question can arise, for example, when a user violates
rules applicable to a particular online space, or annoys other
users to the point of outrage. Is the user in question entitled
to a decision based on analysis of competent evidence, rather
than the whim of a sysop or the cries of an online "lynching"
crowd? Must the decision maker be "neutral"? Should the penalty
fit the crime? To the extent that users desire and expect such
restraint by sysops to whom they give their business, limitations
on sysop action may evolve as a natural evolution of the new
netlaw.

There may be specific attributes of US-based "due
process" that will have little or no applicability online. For
example, a right to a six or twelve person jury -- a limitation
based on historical factors and the constraints on summoning
people to a physical, "real time" courthouse -- that has little
application to the capacity of the networld to allow interaction
with neutral evaluators at their own convenience. U.S. "due
process" guarantees a right to "confront" accusers and witnesses
in person. That right may make little sense when the deeds in
question took place entirely online. U.S. "due process"
guarantees a right to "cross-examine" witnesses in an
elaborate procedural dance. That level of formality may be
unachievable or irrelevant online.

In contrast, certain features of online interaction may
facilitate the growth of new forms of "due process" rights. It
may be judged "fair" to allow an accused party to reply by email
or public posting to any allegations of wrongdoing. It may be
easy, and therefore fairer, to give proactive email notice to any
persons whose actions online are the subject of public
discussion, in order to facilitate such replies. Given the
relative importance of community sentiment and the likely ability
of dispersed contributors to enhance the quality of deliberations
in a particular case, online tribunals may be much more open to
discussion by "friends of the court" -- even to the point of
allowing non-parties to participate in online questioning and
argument.

One important feature of the U.S. doctrine of "due
process" offers protection to corporations and other
organizations that are permitted to act as "legal persons". In
the networld, the whole idea of legal personhood takes on a new
dimension -- because participants in online interactions cannot
easily tell (and may not care) whether an online identity belongs
to only one individual. The networld offers important
opportunities for online collaboration in the delivery of
services and information by means of group action. Accordingly,
it is only a matter of time before the networld faces the
question whether any "due process" rights attach to coherent
groups presenting themselves via email or web pages -- conferring
upon them additional rights and duties distinct from those of
the individual participants. We already allow "real" corporations
to register domain names. It's not clear why such groups need to
be "registered" in any particular physical territory. Exactly how
we go about evolving the protections afforded or denied to
collective entities online may influence what kinds of electronic
commerce can evolve.

One ultimate issue for the development of due process
online will be the question whether to evolve a doctrine that
protects individuals against having to bear undue burdens even if
the policy decisions imposing such burdens are taken for the
greater good. Currently system operators enjoy an "eminent domain"
power unconstrained by any need to compensate the victims of a
reassigned email address, a canceled domain name, or the
enactment of a new rule outlawing some activity which the
individual user had counted on continuing as a commercial
operator. Users maintain some protection against tyranny by
virtue of their ability to move to another system. But a
doctrine insuring compensation for such "takings" would provide
far greater protection against unreasonable burdens imposed by
collective decisions that cannot readily be remedied by migration
-- an increasingly likely type of decision as the networld
welcomes increasingly valuable "investment backed expectations".
(Of course, to be viable, such a doctrine would likely require
something akin to the "taxing" power.) The assertion of such a
claim to compensation may put to the test the question whether
limitations on the power of those charged with online governance
stem only from the ability of unhappy users to desert -- or,
instead, derive from a joint commitment of online "netizens" to
resolve cases rationally and prevent the imposition of unfair
burdens on individual users who do not deserve their fate.

Conclusion

Due Process in cyberspace will concern a different set of
persons -- online personae (whether individual, corporate, or
group) rather than the "citizens" of a given nation state. It
will protect a different set of values -- the continuing "life"
of an online identity, the "liberty" to engage in established
activities free from arbitrary new rules, and the "property" of
an established domain name or well known web page address.
Procedural protections will likely take the form of an assured
opportunity for community discussion, as distinct from physical
rights (such as the "confrontation of witnesses") or particular
"real time" dramatic processes (such as "cross examination").
Indeed, the substantive protections of due process in cyberspace
may well differ in content from place to place, with users free
to choose their online environments on the basis of whether the
local rules suit their needs. But, despite these differences, the
law of most areas of Cyberspace will very likely embody many of
the same core principles that underlie current due process
doctrine: respect for the interests of individuals in the face of
majority oppression, thoughtful and rational evaluation of
individual cases, and appropriate opportunities to participate in
creating and applying the law of the networld.